094334cc79a798b6c7976e494186c572b04b1507989e3228b274982e76ee8b17

Analysis

max time kernel
141s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 11:59

Target

05ca562df84451922ed44e2f3ae94a34_JaffaCakes118.dll
Size

8KB
MD5

05ca562df84451922ed44e2f3ae94a34
SHA1

8eefb360df997dacd91cb4b8a23227caa2e7d55e
SHA256

094334cc79a798b6c7976e494186c572b04b1507989e3228b274982e76ee8b17
SHA512

308a6fcb662e5e6cc3e5e59fcd542a0c0def52d5275174d662fee35660d05201e97796424eb63a9e1efc7dbc48e6ee511a2067b07a1dfd531b8761def129e1fb
SSDEEP

192:VUFK5OJ+J3J22koZ7F3FYqtOgdn7SmPdk0czumuelnkZS:aGOwJ3jXR3FPtVlPMumu23

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 1900	3148	rundll32.exe	91
PID 3148 wrote to memory of 1900	3148	rundll32.exe	91
PID 3148 wrote to memory of 1900	3148	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05ca562df84451922ed44e2f3ae94a34_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\05ca562df84451922ed44e2f3ae94a34_JaffaCakes118.dll,#1
  2⤵
  PID:1900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4340 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:3792

memory/1900-0-0x0000000010000000-0x0000000010004000-memory.dmp

Filesize
16KB

Download